COF-C03 Question 327
Single answerConsumerA data provider has shared a Snowflake secure data share with a retail company. The retail company creates a database from the share and several analysts begin querying the shared tables. One analyst reports that they can see the database in Snowsight, but when they run a SELECT statement against a shared table, they receive an access control error. The analyst's role already has USAGE on the warehouse being used. Which additional privilege is required for the analyst's role to successfully query the shared data?
- A
USAGE on the shared database and USAGE on the shared schema
- B
SELECT on the underlying provider's tables
- C
OWNERSHIP on the database created from the share
- D
REFERENCE_USAGE on the provider's database
Show answer and explanation
Correct answer: A
Explanation
In Snowflake data sharing, the consumer creates a database from a provider's share. The consumer does not receive direct privileges on the provider's underlying objects. Instead, the correct way to enable access is to grant IMPORTED PRIVILEGES on the shared database to the appropriate role in the consumer account, along with USAGE on a warehouse for query execution. This is a common SnowPro Core scenario because candidates must distinguish between normal object grants and access to shared data. Options mentioning direct SELECT on provider tables or OWNERSHIP reflect common misunderstandings. Snowflake documentation on secure data sharing and consumer-side access management explains that imported privileges are used to access databases created from shares.
- A. Correct.
Correct. For a consumer to query objects in a database created from a share, the role needs the appropriate privileges on the imported database objects. In practice, this means granting IMPORTED PRIVILEGES on the shared database to a role, which enables access to all objects in the shared database according to the share. The role also needs warehouse access to run queries. This option is the closest correct representation in an exam-style choice because access requires database/schema usage context in addition to warehouse usage; consumers do not grant object-by-object SELECT on provider tables.
- B. Incorrect.
Incorrect. Consumers cannot be granted direct SELECT privileges on the provider's underlying tables because those objects remain in the provider account. Access is controlled through the share and then granted in the consumer account through imported privileges on the database created from that share. A common misconception is to treat shared objects like regular cross-database objects within the same account.
- C. Incorrect.
Incorrect. OWNERSHIP is not required for analysts to query shared data and would be excessive. OWNERSHIP allows full control over the object, including privilege management, which violates least-privilege practices. Analysts only need the ability to use the shared database through the privileges provided for imported databases plus warehouse access.
- D. Incorrect.
Incorrect. REFERENCE_USAGE is used in specific scenarios involving secure views and cross-database references, typically on the provider side when sharing objects that reference other databases. It is not the privilege a consumer analyst needs to query a standard shared table from a database created from a share.